Top all-time · #361
Socket
Company blog · socket.dev/blog · on HN as ferosssecurityprogramming
Socket is the company blog at socket.dev, writing about security and programming. Since 2022, 152 different Hacker News readers have linked it 630 times, most often “Show HN: Socket – Secure your JavaScript supply chain”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Rarely recommended · 3 of 39 sampled comments recommend it?
Why HN links it
HN readers cite Socket's blog as a source on npm and PyPI malware, supply-chain worms such as Shai-Hulud, and AI-hallucinated package names (slopsquatting). Most mentions are links used as references.
Summarised by Claude from a sample of 39 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Show HN: Socket – Secure your JavaScript supply chain8 people · 31 mentions · first linked 2022-03-01
- /7 people · 8 mentions · first linked 2022-04-09
- Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets7 people · 7 mentions · first linked 2026-03-20
- Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised5 people · 5 mentions · first linked 2025-09-16
- AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach5 people · 5 mentions · first linked 2026-02-14
- Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching For5 people · 5 mentions · first linked 2025-02-04
- NPM Author Qix Compromised via Phishing Email5 people · 5 mentions · first linked 2025-09-08
- Wget to Wipeout: Malicious Go Modules Fetch Destructive Payload5 people · 5 mentions · first linked 2025-05-01
- AI Hallucinations Are Fueling a New Class of Supply Chain Attacks4 people · 4 mentions · first linked 2025-04-10
- Malicious PyPI Wheels Target Bioinformatics and MCP Developers4 people · 4 mentions · first linked 2026-06-09
What Hacker News says?
Also reported here: https://socket.dev/blog/npm-author-qix-compromised-in-major-...
Comment linking /blog/npm-author-qix-compromised-in-major-supply-chain-attack
on “NPM debug and chalk packages compromised”Submitted Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised as a story · 1233 points
HN discussionTips to protect yourself from supply-chain attacks in the JavaScript ecosystem: - Don't update dependencies unless necessary - Don't use `npm` to install NPM packages, use Deno with appropriate sandboxing flags - Sign up for https://socket.dev and/or https://www.aikido.dev - Work inside a VM
Comment linking /
on “NPM debug and chalk packages compromised”Submitted The Everything NPM Package as a story · 192 points
HN discussionWe also caught this right away at Socket, https://socket.dev/blog/npm-author-qix-compromised-in-major-... While it sucks that this happened, the good thing is that the ecosystem mobilized quickly. I think these sorts of incidents really show why package scanning is essential for securing open source package repositories.
Comment linking /blog/npm-author-qix-compromised-in-major-supply-chain-attack
on “NPM debug and chalk packages compromised”Submitted Show HN: Socket – Secure your JavaScript supply chain as a story · 133 points
HN discussionScoket was all over this - https://socket.dev/blog/npm-author-qix-compromised-in-major-...
Comment linking /blog/npm-author-qix-compromised-in-major-supply-chain-attack
on “NPM debug and chalk packages compromised”Submitted The push to ban ransom payments is gaining momentum as a story · 127 points
HN discussionThese days compromised packages are often detected automatically by software that scans all packages uploaded to npm like https://socket.dev or https://snyk.io . So I imagine it's still useful to have those services scan these packages first, before they go out to the masses. Measures like this also aren't meant to be "final solutions" either, but stop-gaps. Slowing the spread can still be helpful when a large scale…
Comment linking /
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted Active NPM supply chain attack: Tinycolor and 40 Packages Compromised as a story · 85 points
HN discussionSeems like this is a fairly recent change, for Pnpm at least, https://socket.dev/blog/pnpm-10-0-0-blocks-lifecycle-scripts... What has been the community reaction? Has allowing scripts been scalable for users? Or could it be described as people blindly copying and pasting allow commands? I am involved in Python packaging discussions and there is a pre-proposal (not at PEP stage yet) at the moment for "wheel variants…
Comment linking /blog/pnpm-10-0-0-blocks-lifecycle-scripts-by-default
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted German Court Fines Security Researcher for Reporting Company's Vulnerabilities as a story · 77 points
HN discussionNot aware of any NPM native ways but here are few community tools: - https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab...
Comment linking /blog/introducing-socket-firewall
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted OpenJS: "XZ Utils Cyberattack Likely Not an Isolated Incident" as a story · 65 points
HN discussionWhat makes you think they _haven't_ tried to work things out with Ruby Central? As per a separate article[1], this seems to be a last resort: > “Since Ruby Central has informed us they will never allow us to continue working on the projects they now claim they own, that we successfully maintained and operated for the last ten years, the former RubyGems team is launching gem.coop today.” [1]: https://socket.dev/blog/…
Comment linking /blog/gem-cooperative-emerges-as-a-community-run-alternative-to-rubygems-org
on “Gem.coop”Submitted What's Going on Inside Your Node_modules Folder? as a story · 64 points
HN discussionThanks. Glad you like our approach. > It would be even better if something like this could be integrated directly into the package management tool itself We're planning to build this. However right now, the primary way to consume Socket.dev data is through our GitHub app ( https://socket.dev/integrations ).
Comment linking /integrations
on “Node.js packages don't deserve trust”Submitted Chinese devs are storing 1000s of eBooks on GitHub and NPM as a story · 62 points
HN discussionWow.. Yeah that's a great example of exposing what's actually going on! Btw, is there a specific reason you're not listing the "yellow issues" from a packages dependencies on its front page? For instance https://socket.dev/npm/package/mongoose doesn't really show anything on the front page, but if you go to "dependency issues" you get "uses network, eval etc.". I think it'd be necessary to treat "dependency issues"…
Comment linking /npm/package/mongoose
on “Node.js packages don't deserve trust”Submitted Unverified NPM Account Takeover Vulnerability for Sale on Dark Web Forum as a story · 53 points
HN discussionWe maintain an automatically updated list of "trivial packages" (defined as less than 10 lines of code) here: https://socket.dev/npm/issue/trivialPackage Is this the type of list you were looking for? It's not a perfect metric and isn't meant to disparage any of the maintainers of these packages, but it's one factor in our Socket.dev risk analysis.
Comment linking /npm/issue/trivialPackage
on “Node.js packages don't deserve trust”Submitted Prettier NPM Packages Compromised in Supply Chain Attack as a story · 45 points
HN discussion(Reposting a comment I posted a few days ago.) There's a few reasons that NPM sees more attacks than other ecosystems. First, the scale of the JavaScript ecosystem. JavaScript is so much larger than every other ecosystem, so even a very small probability event (somebody introducing malware into a package) can happen surprisingly often given the scale of the ecosystem. Supply chain attacks are a problem in all open s…
Comment linking /
on “Node.js packages don't deserve trust”Submitted Namecheap Takes Down Polyfill.io Service Following Supply Chain Attack as a story · 42 points
HN discussionThanks for sharing Socket.dev! Totally agree that a key part of any supply chain security strategy must be understanding what packages actually do when they run. For example, see the package `angular-calendar` which is a calendar/date picker web component. When you look it up on Socket.dev [1], you'll see that it actually uses: - Install scripts - Telemetry to track you - Network access - Shell access - Environment…
Comment linking /npm/package/angular-calendar/issues/0.29.0?tab=dependencies
on “Node.js packages don't deserve trust”Submitted Curl Project and Go Security Teams Reject CVSS as Broken as a story · 40 points
HN discussionFounder of Socket ( https://socket.dev ) here, a new tool built by npm maintainers to help solve JavaScript supply chain security. I totally agree with the idea that we should assume all open source packages may be malicious. Socket.dev uses "deep package inspection" to characterize the behavior of an open source package. By actually analyzing the package code, Socket can detect when packages use security-relevant p…
Comment linking /
on “Node.js packages don't deserve trust”Submitted AI Hallucinations Are Fueling a New Class of Supply Chain Attacks as a story · 31 points
HN discussionThis won't prevent packages you're already giving capabilities to - to later do something evil in a small patch update. So it's not enough - you should also not rely on "automatic security updates" through some sort of semver trust. Lock your dependencies up completely, choose packages with a small dependency tree or zero dependencies, and at the same time use the newly launched https://socket.dev to know what packa…
Comment linking /
on “Node.js packages don't deserve trust”Submitted Gem.Coop – Community-Run Alternative to Rubygems.org, Led by Former Maintainers as a story · 30 points
HN discussion
